Supermicro BMC/IPMI Firmware Flaws (CVE-2026-18450 Critical): Patch Now for Hosting and Colocation Fleets (October 2026)

TL;DR: On 26 October 2026, Supermicro disclosed eight vulnerabilities in the baseboard management controller (BMC) firmware of select Supermicro motherboards, found by researchers at runZero (Supermicro advisory). The most serious, CVE-2026-18450, is rated Critical, CVSS 3.1 9.8 by Supermicro: "The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session." Supermicro lists a fixed BMC firmware version for nearly every affected board; two boards are still marked TBD. What to do: look up each Supermicro board in your fleet in the vendor table, apply the listed BMC firmware, and keep IPMI off any network an attacker could reach.

What lowers the urgency for most readers:

• An active session is needed for the headline flaw. runZero, which found the bug, scores the same flaw lower than Supermicro does: 8.1 (High), with attack complexity High, because an attacker must first identify a live IPMI session ID (runZero advisory). runZero adds that this condition "is often met when IPMI-based monitoring tools are in place."
• No exploitation reported. Supermicro says it "is not aware of any malicious use of these vulnerabilities in the wild." We found no public weaponized exploit or known malicious exploit code for these flaws. runZero does point owners of test equipment to its open-source oobscan scanner "to test for these vulnerabilities"; we treat that as a defender test tool, not a published attack kit.
• Not in CISA KEV. None of the eight CVEs is listed in CISA's exploited-vulnerabilities catalog (live feed, catalogVersion 2026.10.26, checked 27 October 2026, 12:06 Amsterdam time (UTC+1)).

Technical Information

A BMC is a small, separate computer on the server motherboard. It lets administrators power-cycle the server, open its console and reach its storage over the network, even when the main operating system is down. Supermicro BMCs speak IPMI, and IPMI 2.0 sessions (RMCP+) are supposed to protect each command with integrity checks and encryption.

runZero found that on affected firmware, the BMC decides whether to check and decrypt a packet "solely from that packet's own header bits," without comparing them to the cipher suite the session negotiated. A packet with both bits cleared "is dispatched to the command handler with no HMAC verification and no decryption." In runZero's words, "any holder of a live session, including one hijacked by a third party, can send cleartext, unsigned, unencrypted commands and have them executed." runZero demonstrated this on an X13 unit (firmware 1.07) under cipher suite 3 and says "the same holds for cipher suite 17." The commands run with that session's privilege.

How an attacker gets a session ID matters. runZero says session IDs "can be obtained in cleartext from the wire by an on-path attacker." Its advisory also says they can be "guessed from predictable ID sequences." Its blog is more cautious: predictable IDs "have also been suggested as an off-path route, but that behavior has not been firmly established," and a cross-client hijack "was not demonstrated and the vendor disputed the impact" (runZero blog).

All eight CVEs in the advisory, with Supermicro's ratings:

runZero notes that several of these "combine into practical attack chains." For example, CVE-2026-65220 can raise a low-privilege user to Administrator, and administrator access "can in turn reach" the file-read and memory-write flaws. runZero says the memory-write path "can give persistent BMC control."

Same-day related advisory. Supermicro also published a second BMC advisory on 26 October for CVE-2026-16521 (High, CVSS 7.2), an OS command injection in the BMC syslog feature that needs administrator privileges. It was reported by a different researcher, Jihye Lee of Korea University (Supermicro advisory 2). Its fixed versions largely match advisory 1.

Timeline

All times are Amsterdam time (UTC+1). Research dates are from runZero.

• 24 July 2026: runZero notifies Supermicro.
• 6 August 2026: Supermicro reserves CVE-2026-18450.
• 26 October 2026: Supermicro publishes both advisories (version 1.0). runZero publishes its advisory and a 26 October update to its blog the same day.
• 27 October 2026, 09:16 to 10:16: NVD publishes all nine CVEs.
• 27 October 2026, 12:06: Rescana re-checks the federal exploited-vulnerabilities catalog. None of the nine CVEs is listed.

CVE, NVD and KEV status (checked 27 October 2026, about 12:06 Amsterdam time (UTC+1))

• NVD: all nine CVEs are published with status "Received." The only scores are the CVE Numbering Authority's (marked "Secondary" by NVD), and they match Supermicro's advisory. CVE-2026-18450 shows 9.8 Critical, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-306 (Missing Authentication for Critical Function). NVD has not scored it itself yet (NVD).
• Researcher score: runZero estimates 8.1 High, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
• Not listed in the CISA exploited-vulnerabilities catalog (catalogVersion 2026.10.26).

Affected Product Versions

Supermicro says the issues affect BMC firmware on "select" Supermicro boards and that "All affected Supermicro motherboard SKUs will require a BMC update." Its advisory has a long table of affected boards, each with the BMC firmware version that contains the fix. The table covers boards in the X11, X12, X13 and X14 (Intel) and H11, H12, H13 and H14 (AMD) families. It also lists M11/M12, A3, B-series, C9X299, G1/G2 and R12/R13 boards, SSE-T series switches and the CMM-6 chassis management module.

Use the vendor table for exact board-to-version matches. Some examples from it:

Points to check:

• Older boards. runZero's CVE-2026-18450 advisory lists X9 (X9DRT-HF) and X10 among the products it covers. Supermicro's fix table has no X9 or X10 boards, so we could not confirm a fix for them.
• Firmware still being validated. Supermicro says updated firmware "has been created" and also that it "is currently testing and validating affected products. Please check Release notes for the resolution." Check the release notes for your board before you roll out.
• X14 scope. runZero says CVE-2026-18450 affects BMCs "prior to X14," while CVE-2026-65213 affects X14. Supermicro's single table covers all eight CVEs and does not map boards to individual CVEs. Treat every listed board as needing the update.

Workaround and Mitigation

1. Update BMC firmware. Match each server's motherboard to Supermicro's table and install the listed BMC firmware version. Start with any BMC that can be reached from outside a dedicated management network.
2. Isolate IPMI. Keep BMC interfaces (IPMI on UDP port 623, the web UI and KVM) on a separate management network that user, production and internet traffic cannot reach. runZero's guidance: "IPMI shouldn't be casually reachable from user networks, production application segments, or certainly the public internet." (Port number is Rescana guidance; UDP 623 is the standard IPMI-over-LAN port.)
3. Reduce session exposure until you patch. CVE-2026-18450 needs a live session, and runZero notes that IPMI monitoring tools often keep one open. Where you can, poll BMCs only over the isolated management network, and turn off IPMI over LAN on BMCs that do not need it. (Rescana guidance.)
4. Check SMCRAKP. runZero says CVE-2026-18449 applies when the optional SMCRAKP mode is enabled. If you do not need it, leave it off. (Rescana reading of runZero's note.)
5. Find your BMCs. Many teams do not have a full list of their BMCs. runZero points out that a normal server inventory may not show the BMC at all. Scan your own networks for IPMI listeners and compare the results with what should be on the management network.
6. Follow Supermicro's BMC hardening guidance. Supermicro's Security Center links its BMC Security Guide and best practices.

Indicators of Compromise

None published. Neither Supermicro nor runZero has released indicators of compromise for these CVEs, and we found none from CISA. As a hunting starting point (Rescana guidance, not published IoCs), look for IPMI traffic to BMCs from hosts outside your management network, and for unexpected new IPMI sessions, user changes or privilege changes in BMC event logs.

Why this matters for vendor risk

Hosting providers, colocation operators, managed service providers and data-center operators often run large Supermicro fleets and manage them through IPMI, sometimes with monitoring tools that keep sessions open. Control of a BMC means control of the server underneath your workload: power, console and storage, outside the operating system. You cannot see a provider's BMC network or firmware version from the outside, so ask your infrastructure vendors:

• Do you run Supermicro servers, and is any BMC or IPMI interface reachable from untrusted or shared networks?
• Have you applied Supermicro's 26 October 2026 BMC firmware, and when will the whole fleet be done? What is the plan for boards with no fixed version yet?
• Is IPMI on an isolated management network, with integrity and encryption enforced and IPMI over LAN turned off where it is not needed?

What we will update: We will update this post if CISA adds any of these CVEs to KEV, if Supermicro or runZero reports exploitation or publishes IoCs, if NVD publishes its own scores, or if Supermicro adds fixed versions for TBD boards.

If your critical vendors run on rented or colocated servers, a quick question about their BMC patch status now is worth the effort. Want an evidence-based view of how exposed your vendor ecosystem is to flaws like this? Book a demo.

Sources

• Supermicro (vendor), "Vulnerabilities in Supermicro BMC firmware, October 26, 2026 (1)": https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1
• Supermicro (vendor), "Vulnerabilities in Supermicro BMC firmware, October 26, 2026 (2)": https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_2
• Supermicro Security Center: https://www.supermicro.com/en/support/security_center
• runZero (researcher), "Supermicro BMC Unauthenticated IPMI Commands" (CVE-2026-18450): https://www.runzero.com/advisories/smc-ipmi-auth-bypass-cve-2026-18450/
• runZero (researcher), "Lights Out: The server in your server, exposed and disclosed" (26 Oct 2026 update): https://www.runzero.com/blog/lights-out-exposed/
• NIST NVD, CVE-2026-18450: https://nvd.nist.gov/vuln/detail/CVE-2026-18450
• CISA, exploited-vulnerabilities catalog (live JSON feed): https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json